Friday, January 28, 2005

$100 Home Recording Studio

E-MU 0404 Digital Audio System

The PC has turned media into an active creation activity, instead of just a passive, TV-watching, radio-listening "let-it-wash-over-you" experience. We can make and edit movies. We can doctor digital photos. We can record and remix music.

While you can do basic recording using your motherboard's integrated audio, in most cases the results won't sound especially good. An Audigy 2 sound card has clean enough inputs and outputs to do some home recording, and even supports ASIO, the driver standard for most professional and prosumer audio applications. But it lacks the 1/4-inch jacks you'll want for connecting instruments. If you're ready to get more serious, it's time to leave the world of sound cards behind, and delve into the realm of audio interface cards.

A semantic difference, you say? Not really. Audio interface cards are specifically designed for audio and music production. They usually won't accelerate game audio, and their mixer applications are much more intricate and granular. They also offer up a lot more I/O—both analog and digital. Cards offering 8-in/8-out are typical, and are usually priced at around $400–$500. Also, the software bundles usually come with audio sequencers and wave editors rather than media player applications and games.

Another important difference is the price: Most decent audio interfaces start at $150 and head north from there. Cards like M-Audio's Delta 44, Echo Audio's Mia MIDI and E-MU's 1212M are in this price band, and all represent good entry-level solutions. But E-MU has gone one better. The company has taken its 1212M interface, and trimmed some features from it to produce the 0404, a $99 2-in/2-out (analog) audio interface card that delivers very impressive performance at that price point.

Are you ready to get your groove on and gear up to record all those musical ideas dancing around in your head? Read on to see if the 0404 is the right place to start for you. Continued...

TABLE OF CONTENTS
Introduction
Guided Tour
How We Tested
RightMark Audio Analyzer Results
SoundForge Noise Floor Results
Hands-On Time
The Proteus X Synth Software
Final Thoughts/What to Buy

http://www.extremetech.com/article2/0,1558,1753502,00.asp

Return of the Browser Wars

By Jerry Pournelle
July 26, 2004
(Return of the Browser Wars : Page 1 of 1 )
Column 288 (Continued from the Previous Month)

“The Big Question: Internet Explorer

The VX2 spyware scare was one problem. Another was Download.Ject, aka Scob, and called by some The Russian Hack. This exploited vulnerabilities in the Microsoft IIS servers (one reason why Apache has a significant web server market share) to broadcast malware that exploited in turn Internet Explorer vulnerabilities. That was significant because it caused some journalists to advise users to abandon Internet Explorer entirely. Others didn't go that far, but did say that one ought not use Microsoft Internet Explorer as one's default Internet browser. Perhaps the most extreme statement was "The U.S. government's Computer Emergency Readiness Team (US-CERT) is warning Web surfers to stop using Microsoft's Internet Explorer (IE) browser."

For those unfamiliar with it, US-CERT "is a partnership between the Department of Homeland Security and the public and private sectors. Established to protect the nation's Internet infrastructure, US-CERT coordinates defense against and responses to cyber attacks across the nation," so a warning from US-CERT is pretty serious, and if they're advising you to "stop using Microsoft's Internet Explorer (IE) browser," it may be time to do just that.

All of which prompted a call to Microsoft's public relations people, who arranged a telephone interview with two senior program managers on Microsoft's Security team.

Microsoft's Side of the Story

My interview was with Gary Schare, Director of Security Project Management for Windows, and some of his team.

First, regarding CERT advice to drop IE, they said "We haven't seen any such CERT headline. We've seen journalists who report it, but we can't find any such thing." Which prompted me to go do my own search, and they're right: While I see a number of signed editorials and columns stating that this is CERT's advice, I found no URL linking that statement to CERT itself, and my search of CERT didn't turn it up either.

CERT does have a warning entitled "Microsoft Internet Explorer does not properly validate source of redirected frame," and if you scroll down past a number of other suggestions, the last one is

Use a different web browser

There are a number of significant vulnerabilities in technologies relating to the IE domain/zone security model, the DHTML object model, MIME type determination, and ActiveX. It is possible to reduce exposure to these vulnerabilities by using a different web browser, especially when browsing untrusted sites. Such a decision may, however, reduce the functionality of sites that require IE-specific features such as DHTML, VBScript, and ActiveX. Note that using a different web browser will not remove IE from a Windows system, and other programs may invoke IE, the WebBrowser ActiveX control, or the HTML rendering engine (MSHTML).

but that is not quite the same as saying ‘Don't use Internet Explorer,’ and a very long way from ‘CERT says use anything but IE.’ ”


http://www.byte.com/documents/s=9011/byt1090781086558/0726_pournelle.html?temp=1h6pvBLxoD

Dear IE, I'm leaving you for good

By Robert Vamosi
Senior editor, CNET Reviews
“Dear Internet Explorer:

It's over. Our relationship just hasn't been working for a while, and now, this is it. I'm leaving you for another browser.


I know this isn't a good time--you're down with yet another virus. I do hope you feel better soon--really, I do--but I, too, have to move on with my life. Fact is, in the entire time I've known you, you seem to always have a virus or an occasional worm. You should really see a doctor.

That said, I just can't continue with this relationship any longer. I know you say you'll fix things, that next time it'll go better--but that's what you said the last time--and the time before that. Each time I believed you.

Well, not any longer.

http://builder.com.com/5100-6371_14-5455092.html?tag=nl.e601

Google Video: Beta

“Search recent TV programs online.”

Preferences

Google Video Help

http://video.google.com/

Wednesday, January 26, 2005

Microsoft Cites IP Defense in Blogger Crackdown

By Mary Jo Foley

“On the heels of Apple Computer's attempt to crack down on journalists for allegedly misappropriating trade secrets, some free-speech advocates are worried that Microsoft has launched a similar campaign.

In a Jan. 18 letter it said was issued on behalf of Microsoft, the law firm of Covington & Burling asked the publisher of tech-enthusiast site Engadget.com to remove screenshots of a forthcoming Microsoft operating-system release known as "Windows Mobile 2005." According to the request, Microsoft considers the images to contain "proprietary trade secret information belonging to Microsoft."

Microsoft also requested that two other Windows-focused sites, Neowin.net and Bink.nu, remove related information from their Web sites. Neowin was the first site to publish in early January the alleged screen shots and development schedule for Windows Mobile 2005.

Neowin and Bink removed the Windows Mobile 2005 information at Microsoft's request. (Neowin received a phone request from a Microsoft representative and Bink, an e-mail one from a "Microsoft Internet Investigator," site principal Steven Bink said.)

As of the time this article was published, Engadget publisher Weblogs Inc. still had not removed the Windows Mobile 2005 screen shots and information from its site.

Microsoft did not respond to questions from Microsoft Watch about whether it is stepping up its campaign to limit the publication of information it considers trade secrets.

http://www.microsoft-watch.com/article2/0,1995,1753658,00.asp


Monday, January 24, 2005

Use JavaScript to create a DataGrid control with inline editing

by Greg Griffiths

“Several of my colleagues have been very busy recently working on all manner of ASP.Net applications and components for use within our company. Recently, they demonstrated a DataGrid control that they had developed that allowed in-line editing (see the MSDN Article). After I had congratulated them on a wonderful control, one of the team commented that this kind of functionality would not be possible using only JavaScript—one of my favorite languages—so I decided to see if that was the case, and this article is the story of my journey.

What Functionality do we need?

Looking at the control they had produced, I was able to identify the following items of functionality that I needed to create to complete my challenge:

  • Populate a table with data via JavaScript.
  • Add sorting functionality.
  • Add inline editing functionality.
  • Add paging functionality.
  • Add functionality to add/delete elements.

http://techrepublic.com.com/5100-6228_11-5533726.html?tag=nl.e103

Friday, January 21, 2005

Flaw found in Office encryption

Flaw found in Office encryption:

“The data protection feature in Microsoft Word and Excel documents has a major flaw that could allow snoopers to decode password-protected files, a security researcher has warned.

The problem arises because Microsoft programmers did not implement the encryption correctly in its Office applications, Hongjun Wu, a cryptographer at the Institute of Infocomm Research in Singapore, wrote in a paper on the topic.

‘A lot of information could be retrieved from those encrypted files,’ Wu said in the paper. ‘If anyone has used the encryption in Microsoft Office...then it is time for him/her to assess the damage that has been caused.’

The current issue is almost identical to the weak system key issue in 1999, said Bruce Schneier, chief technology officer of Counterpane Internet Security and author of "Applied Cryptography."

"This is a kindergarten crypto mistake," Schneier said. "And to make it twice is worse."

Schneier, who wrote about the issue on his blog earlier this week, hammered at Microsoft for not learning from past mistakes.

Microsoft RC4 Flaw

One of the most important rules of stream ciphers is to never use the same keystream to encrypt two different documents. If someone does, you can break the encryption by XORing the two ciphertext streams together. The keystream drops out, and you end up with plaintext XORed with plaintext -- and you can easily recover the two plaintexts using letter frequency analysis and other basic techniques.

The easy way to prevent this attack is to use a unique initialization vector (IV) in addition to the key whenever you encrypt a document.

Microsoft uses the RC4 stream cipher in both Word and Excel. And they make this mistake. Hongjun Wu has details (link is a PDF).

In this report, we point out a serious security flaw in Microsoft Word and Excel. The stream cipher RC4 [9] with key length up to 128 bits is used in Microsoft Word and Excel to protect the documents. But when an encrypted document gets modified and saved, the initialization vector remains the same and thus the same keystream generated from RC4 is applied to encrypt the different versions of that document. The consequence is disastrous since a lot of information of the document could be recovered easily.

This isn't new. Microsoft made the same mistake in 1999 with RC4 in WinNT Syskey. Five years later, Microsoft has the same flaw in other products.”


http://www.schneier.com/blog/archives/2005/01/microsoft_rc4_f.html

http://eprint.iacr.org/2005/007.pdf

http://news.zdnet.com/2100-1009_22-5543940.html?tag=nl.e589

Latest MSN Messenger Worm Can Hijack System Info

Latest MSN Messenger Worm Can Hijack System Info:

“The latest threat comes follows October's Funner worm attack and signals a growing trend to use instant messaging as a delivery mechanism for malicious activity.

According to an advisory from F-Secure, the new W32/Bropia-A worm users MSN Messenger to lure users into downloading one of the following files: "Drunk_lol.pif"; "Webcam_004.pif"; "sexy_bedroom.pif"; "naked_party.pif"; or "love_me.pif."

Once executed, Bropia-A also drops a variant of the Rbot backdoor Trojan. Rbot represents the large family of backdoors fitted with the ability to control a victim's machine remotely by sending specific commands via IRC channels.

F-Secure warned that the bot can also be used to hijack system information, log keystrokes, relay spam or steal sensitive data. Bropia.A can also disable a mouse's right button and manipulate Windows mixer volume settings, according to the company.


http://www.eweek.com/article2/0,1759,1752988,00.asp?kc=ewnws012105dtx1k0000599

Sun Fixes Critical Java Plug-In Flaws

Sun Fixes Critical Java Plug-In Flaws :
“A pair of vulnerabilities in the Sun Java Plug-In technology could put users at risk of system bypass attacks, Sun Microsystems Inc. confirmed Thursday.

The Santa Clara, Calif.-based company said the more serious of the two vulnerabilities could allow an untrusted applet to elevate privileges through JavaScript calling into Java code. For example, an untrusted applet may grant itself permissions to read and write local files, or may execute local applications that are accessible to the user running the untrusted applet.

A second bug may allow an untrusted applet to inappropriately interfere with another applet in the same Web page, the company said, noting that the interference may cause the applet to incorrectly load non-code resources such as files and Web pages.

The Java Plug-in technology is included as part of the Java 2 Runtime Environment, Standard Edition (JRE). It is used to establish a connection between popular browsers and the Java platform, allowing applets on Web sites to be run within a browser on the desktop.

Independent security research firm Secunia rates the flaws as "extremely critical," and it is urging users to apply the vendor patches immediately.

Sun Java JRE 1.3.x, Sun Java JRE 1.4.x, Sun Java SDK 1.3.x and Sun Java SDK 1.4.x.”

http://www.eweek.com/article2/0,1759,1753018,00.asp?kc=ewnws012105dtx1k0000599

'Evil Twin' Haunts Wi-Fi Users

'Evil Twin' Haunts Wi-Fi Users :
“An IT security expert, an academic and the U.K. government's cybercrime unit will give Londoners an introduction to the security dangers of wireless networking on Thursday—with the star of the show being an attack method dubbed the "Evil Twin."

The Evil Twin is essentially a wireless version of a phishing scam—users think they're connecting to a genuine hot spot but are actually connecting to a malicious server, which can then extract information such as bank details. The attack can be carried out by anyone with the right equipment in the vicinity of a legitimate base station, according to Dr. Phil Nobles, wireless Internet and cybercrime expert at the U.K.'s Cranfield University.

"The [malicious base station] jams the connection to a legitimate base station by sending a stronger signal within close proximity to the wireless client, thereby turning itself into an 'Evil Twin,'" Nobles said in a statement. Users are invited to connect via a fake log-in prompt, he said. Nobles will be demonstrating this and other attack methods at the Science Museum in London.

The free event—which also includes presentations from the U.K.'s National High Tech Crime Unit and an IT security specialist—is designed to give the public some idea of the potential dangers they face when using public Wi-Fi hot spots. The U.K. has one of the highest concentrations of Wi-Fi hot spots in the world, with over 1,000 commercial hot spots in London alone. Overall, the U.K. has more than 9,300 hot spots, second only to the United States, with more than 22,000, according to online Wi-Fi guide Jiwire.com.

Users can mitigate most problems simply by turning security measures on. Most wireless laptops ship with security deactivated.

http://www.eweek.com/article2/0,1759,1752906,00.asp?kc=ewnws012105dtx1k0000599

Thursday, January 20, 2005

Diligently maintain your firewall and antivirus software

Diligently maintain your firewall and antivirus software:
“The most tempting target for a veteran cracker is a developer’s network because beating top programmers puts a feather in their hat. While a server that contains unencrypted personal financial records is a favorite mark for crooks out to make money, some of the most skilled crackers still see breaking other people’s work as a fun game. For them, penetrating a development platform is the best way to find confidential code, plant a back door, or prove their chops by showing what they can do.…

Developer networks are often the least secure in the company because these networks must be open enough to share code easily, have actual code rather than just complied programs, and frequently contain older versions of protocols and software. It's essential to have a firewall between the network and the rest of the company, as well as between the developer network and the Internet (unless under the rare circumstances in which the workgroup is all located in one office and uses a dedicated network without any outside access).

Developer networks also tend to get the least security maintenance. Programmers are so busy, and management may think that since the programmers are experts their network doesn’t need special attention. Developers are likely doing the most time-sensitive, mission-critical jobs in the company, and no one wants to be blamed for shutting down a network by applying a patch that doesn’t work right or by kicking all the users off for routine maintenance.

If security software was perfect, you could lock down the developer network with a solid firewall and good antivirus software. After all, programmers are far less likely to browse the Web or open e-mail attachments from strangers than most office workers, and those two occurrences are the prime causes of security problems.

http://builder.com.com/5100-6387_14-5171910.html?tag=nl.e601

CSS Tooltips - Part Two

CSS Tooltips - Part Two:
By: John Gallant , Holly Bergevin

“In Part One of this CSS Tooltips series, we covered the basic coding necessary to create a hovered pop-up that can serve as a supplemental "tooltip" explanation for a link. The next step is to arrange for this effect to be used with any page element, and not just links.

A Matter Of Support

The heart of the CSS tooltip method depends on the :hover pseudo-class. The W3C makes no restrictions as to which elements may be in the :hover state. In theory this means it can apply to any page element. Most modern browsers now support this CSS 2 feature, but sadly, Internet Explorer for Windows lags behind in this area. IE/Win supports the CSS :hover pseudo-class only on link elements. It's really too bad, because having clean CSS tooltips for an image or a complex math formula would be highly desirable to most authors.

However, it happens that IE5/Win and above can be made to support hovering on any element, via a (freely available) jscript called from within the CSS file. Microsoft calls this proprietary "pathway" for the Jscript a behavior. Calling a script from within a CSS file is a non-valid use of CSS, and normally we would not recommend any such thing. But in this case it's a matter of making IE "support" a standard CSS rule that it otherwise would not.

Further, it's possible to place this "behavior call" in a separate style sheet and link that CSS into a page from within a conditional comment (also Microsoft proprietary code) that appears to other browsers as just a normal comment. Only IE will look inside and see the behavior code lurking within!

Thus, for us code purists the result is nice clean HTML and CSS, with all the invalid code squirreled away out of sight. Explorer can see that invalid code only because it is capable of looking inside HTML comments for extra code it can parse. The W3C specifications don't care what lies within any HTML comments, so the page will validate just fine. ”

http://www.communitymx.com/content/article.cfm?cid=52428


Wednesday, January 19, 2005

Worm exploits tsunami to spread virus

Worm exploits tsunami to spread virus:

A mass e-mail posing as a plea for aid to help the victims of last month's Asian tsunami disaster is actually a vehicle for spreading a computer virus, Web security firm Sophos said Monday.

The worm appears with the subject line: "Tsunami donation! Please help!" and invites recipients to open an attachment called "tsunami.exe"--which, if opened, will forward the virus to other Internet users.

It could also initiate a denial-of-service attack against a German hacking Web Site, Sophos said, in which the site's server would be bombarded with messages, putting it out of action.

"Duping innocent users into believing that they may be helping the tsunami disaster aid efforts shows hackers stooping to a new low," Sophos senior technology consultant Graham Cluley said in a statement.

Sophos added that it had so far received only a small number of reports of the worm, which it said was not the first to try to take advantage of the Indian Ocean catastrophe in order to spread.

Another worm earlier this month propagated the message that the tsunami was God's revenge on "people who did bad on earth."

And there have been a number of mass e-mails sent out in an attempt to steal money, many of them versions of the so-called Nigerian Letter scam, to which readers are invited to reply with their details, apparently in order to help transfer large sums of money and receive a cut themselves.


http://news.zdnet.com/2100-1009_22-5539215.html?tag=nl.e539

Advanced Windows XP User Features

Advanced Windows XP User Features:
By John Mueller, Peter Norton.

“Windows XP comes with more ways to modify your interface than any previous version of Windows. Not only can you use the new Windows interface, but many of the features of the Windows 2000 interface are available as well. All of this flexibility means that you can have the interface you really want—the one that will make you most productive. Unfortunately, all of this flexibility can also mean confusion on the part of the user. That's why I placed what I consider advanced user features in a separate chapter.

In the preceding chapter, we looked at the simplified Windows XP interface. This interface is easy to use, but doesn't provide much in the way of flexibility. Windows XP also supports what I call a standard interface, the kind of interface that most Windows users have come to expect. This chapter will show you how to convert from the simplified interface to the standard interface that many power users will want. In addition, we'll discuss how to obtain the Windows 2000 interface. Just because you're using Windows XP doesn't mean that you have to settle for an interface that doesn't suit your tastes.

Part of using the standard interface is negotiating the Classic Start Menu, the one found in previous versions of Windows. Chapter 2 discussed the new, simplified Start Menu that you'll see when you start Windows XP. This chapter concentrates on the standard menu components as well as on the standard toolbars. In fact, I'll show you how to create your own toolbars to make working with Windows more efficient.

One issue we really didn't discuss in the preceding chapter is the Desktop—the part of the display where you place icons, applications, and data files. Windows XP has two different Desktops. The first is the standard desktop found in even the old versions of Windows 9x. The second is the relatively new Active Desktop. We'll discuss both desktops, and you'll discover how to make maximum use of the Active Desktop if you decide to take the plunge and use it.

This chapter discusses advanced Explorer techniques. You'll learn how to configure Explorer to suit your needs and use it to reconfigure your system, and you'll even get some customization tricks that no one should be without. Most importantly, you'll learn why this tool is so essential for novice and expert alike.

This chapter ends with a discussion of some important but miscellaneous interface configuration issues. You'll learn about the Startup folder and how to use it to make your system self-configuring (at least to an extent). Anyone who has read Chapter 2 will see the effects of using Web content in folders. You can change the appearance of the Web content to suit your needs, so the effects in Chapter 2 are only the beginning. These sections will also tell you about screen savers and themes. If you used themes under Windows 9x and liked them, you really need to see how Microsoft has improved theme support for Windows XP.

Switching to the Standard Interface

The simplified Windows XP interface has many appealing features, but it also hides some of the power of Windows. If you perform the same tasks every day, the hidden features may not make much of a difference. An accountant who uses the same application all day to compute someone's tax bill won't worry much if he or she doesn't see the Administrative Tools folder. However, many power users will find the hunt for their favorite administrative tool frustrating. Speed is of the essence for the power user.

The standard interface is one that reflects the power of the original Windows 9x interface and the functionality of the Windows XP feature set. It allows a power user to find what he needs quickly. The same interface that confuses the novice and thwarts someone who performs the same task every day makes the power user more efficient. I'm making these distinctions because the myth of the perfect interface seems to pervade the media. The perfect interface is a myth. There's only the interface that works best for you, which is why I'm happy to see that Microsoft is adding much-needed flexibility to Windows XP.

Enabling the standard interface is as simple as making a few changes to your environment. Begin by right-clicking the Start Menu and selecting Properties.


http://www.informit.com/articles/article.asp?p=29744

Tuesday, January 18, 2005

Company offers 10GB of Net storage, for free

Company
offers 10GB of Net storage, for free
:
A company called Streamload is offering consumers a
free 10 gigabyte online storage locker for multimedia files,
potentially raising the stakes for larger companies such as Yahoo and
America Online.


Streamload typically provides online storage space for a price, making
it one of the few companies to survive in that business through the
dot-com shakeout. However, it is increasingly competing with larger
companies that offer online homes for digital photographs, and even
the huge archive space provided by Google's Gmail service.

Company executives say the offer of big online storage lockers, once
used only by advanced computer users, is now more relevant to a
broader public that has large collections of digital photographs and
MP3 files.

"It seems to have come to appeal not only to the hard-core early
adopters, but to mainstream users," Streamload CEO Steve Iverson said.
"It's no longer a novelty to have an MP3 player, and even having a
place online to store MP3 files so you can fill up your iPod on the
road has become more common."

Iverson's argument illustrates one side of a race between falling
prices for data storage, such as computer hard drives, and the
increasing ease of storing data on a network.

Some computer experts have argued that when all devices are connected
to the Net, storing data locally will be unnecessary. Others note that
cheap hard drives that are expanding to hold hundreds of gigabytes
mean that it will be more efficient to store data locally whenever
possible.

Streamload's service does allow its customers to share files stored on
the system, much as Yahoo Photos allows subscribers to provide access
to photographs to friends. In the past, this has led to online storage
lockers being used to hold and distribute pirated music, movies and
software, but Iverson said his company had guards in place against
this.

People who sign up for the free 10GB service can only download 100MB a
month and can only upload files of 100MB at a time. Customers who pay
about $10 a month have much looser restrictions. ”

http://news.zdnet.com/2100-9588_22-5537230.html?part=rss&tag=feed&subj=zdnet

Microsoft: No Plans to Tweak DRM Download Mechanism

Microsoft: No Plans to Tweak DRM Download Mechanism:

“Amid reports that malicious hackers are using the anti-piracy mechanism to infect computers with spyware, adware, dialers and computer viruses, Microsoft officials stressed that the latest attack scenario does not exploit a vulnerability in the software.

"Not every problem comes with an automatic technology solution. In this case, the priority is to educate users and get them to understand the importance of not downloading files from untrusted sources," said Mike Coleman, lead product manager with Microsoft's Windows division.

"If strangers are trying to entice you to open a file, chances are they're setting you up for a bad experience. We need to continue our work on getting people to understand what's going on and get them to develop better download habits," Coleman told eWEEK.com.

Security experts warn that crackers are rigging .wmv files to use the DRM (digital rights management) features of Windows Media Player to browse sites infested with malware.

The WMP software includes an option to "acquire licenses automatically for protected content." When a user tries to play a DRM-protected file, the software triggers an Internet Explorer browser session and walks the user through the installation process.

Ben Edelman, a Harvard University student who tracks the spyware scourge, has published a demonstration of the exploits and warned that users with older versions of Windows will receive "confusing and misleading messages" regarding the DRM licenses.

After attempting to download the DRM license, Edelman said his test computer became infected with 58 folders, 786 files and a whopping 11,915 registry entries. "Not one of these programs had showed me any license agreement, nor had I consented to their installation on my computer," he said.

Tom Liston, a researcher who tracks malicious Internet activity for the SANS Internet Storm Center, said the attack scenario puts users at risk even if they use an alternative browser. "You're only as safe as the version of IE installed on your system."

Panda Software said the rigged video files are being distributed on peer-to-peer networks to dump two Trojans—Trj/WmvDownloader.A and Trj/WmvDownloader.B—on PCs.

Microsoft's Coleman said the company takes all security risks seriously and urged Windows users to take advantage of the protections built into Windows XP Service Pack 2.


http://www.eweek.com/article2/0,1759,1751248,00.asp?kc=EWRSS03129TX1K0000610v

Searching for Quick Answers To Odd Questions

Searching for Quick Answers To Odd Questions:
By Mary Ellen Bates
Looking for an obscure fact, and need the answer right now? Forget search engines: Specialized search tools can help you track down offbeat information in a flash.

Search engines are great, but they often obscure simple, direct answers to straightforward questions in a sea of other information. For example, what was the original title of the first Godzilla movie? (Gojira, released in 1954) Who said "I'm as pure as the driven slush?" (Tallulah Bankhead) What percentage of adults have gone to a jazz performance in the last year? (11%).

Here are a few of my favorite sites for finding answers to those there-must-be-an-answer-out-there questions.

For the electronic equivalent to the "ready reference" shelf of resources that most librarians keep hidden behind their desks, check out RefDesk. It is particularly good for answering factual questions—Where do I get the new Windows XP Service Pack? Where is the 386 area code? How do I contact my member of Congress?

Another resource for lots of those quick-fact questions is InfoPlease, the publishers of the Information Please almanac. Right now, it's full of Olympics data, but it also has links to facts and factoids that you would look up in an almanac, atlas, or encyclopedia.

If you want numbers, start with the Statistical Abstract of the US. This source, produced by the U.S. Census Bureau, gives you everything from the divorce rate by state to airline cost indexes going back to 1980. It's a virtual "secret weapon" for pulling numbers together quickly.


http://searchenginewatch.com/searchday/article.php/3450911

Google Plugs Cookie-Theft Data Leak

Google Plugs Cookie-Theft Data Leak :

“For the second time this week, security flaws in the company's Web-based products have been uncovered, and the latest—in the Froogle comparison-shopping service—could have serious ramifications for Google's attempt at identity management.

In a statement sent to eWEEK.com, the search darling confirmed it was alerted to a "potential security vulnerability affecting Froogle," but no details were provided.

"We have since fixed this vulnerability, and all current and future Froogle users are protected," Google said.

According to Israeli security researcher Nir Goldshlager, a malicious hacker could exploit the hole by embedding a JavaScript in a URL pointing to Froogle. Once the link is clicked, the JavaScript triggers a browser redirect to a malicious Web site where the target's Google cookie is stolen.

Goldshlager, who was recently credited with finding a flaw in the Lycos e-mail service, said the cookie contains usernames and passwords for the "Google Accounts" centralized log-in service. He said the flaw also could be used to hijack Gmail accounts.

The Google Accounts identity management service is programmed to provide universal access to all Google services that require a login.

It powers logins for Google Groups, Google Alerts, Google Answers and Google Web APIs, and plans are in place to expand the service to include Google Adwords and the company's e-commerce store.

"The system authenticates the hacker as the victim, using the stolen cookie file. Thus no password is involved in the authentication process. The victim can change his password as many times as he wants, and it still won't stop the hacker from using his box," Goldshlager said.

Earlier this week, Google was forced to address a separate bug in Gmail that allowed access to other users' personal e-mails. By altering the "From" address field of an e-mail sent to the service, a malicious hacker could potentially find out a user's personal information, including passwords.


http://www.eweek.com/article2/0,1759,1751689,00.asp?kc=ewnws011705dtx1k0300599

Saturday, January 15, 2005

Crypto-Gram Newsletter January 2005

Crypto-Gram Newsletter
January 15, 2005

“In this issue:

A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit http://www.schneier.com/crypto-gram.html.”


http://www.schneier.com/crypto-gram-0501.html

The Right Way to Link To Pages On Your Site

The Right Way to Link To Pages On Your Site:
By Dave Taylor

“Here's a topic that should be obvious, but isn't: how should you best code links on your site from page to page? Should you use something like "page two" or "continued..." or "more" with the page filenames as the links? Should you use absolute links that always begin with a leading / (as in "/reviews.html"), should you always use relative links (as in "../reviews.html") or should you use fully qualified links (as in "http://www.informit.com/reviews.html")?

The answer to this question might surprise you! First off, innuendo and rumor aside, Google and other search engines do not care about how your links are coded. I have read on some SEO (search engine optimization) sites that people suggest that Google "spiders" your site faster if you have absolute or even fully-qualified URLs, but as far as I can ascertain, that's just not true.

So this facet of the question boils down to what's the easiest for you to maintain on your site? A link that allows you to move all the pages around as you might need to reorganize things, or a link that forces you to always live with a specific domain name and directory name? My druthers is unquestionably to use relative links as much as possible, and to always use absolute (though not fully-qualified) links on 404 error pages and other content that kind of floats around on your site.

The only area where full, absolute URLs are a necessity are weblog entries, because your Weblog entries should be generating an RSS feed which is then read by subscribers in their own applications, so relative links almost always fail. This means that it's a bit more tricky to add links to certain content – especially if it is built around the Movable Type (or other) weblog content management system -- but the trade-off of having clickable links in the RSS feed makes it worthwhile.



http://www.informit.com/articles/article.asp?p=361413

Understanding Keyword Density

Understanding Keyword Density:

“Search engine optimization, or "SEO" in the biz, isn't only for people trying to turn their Web site into a revenue machine, to make money online, but can really be useful for everyone building Web sites. There are lots of different facets to writing, designing and adjusting your Web pages to maximize the chance of them being a top result for search terms, but one of the best - and easiest - is to work with keyword density.

What is keyword density? It's basically a measurement of how relevant a given keyword "topic" is to a page of material. For example, this page is quite relevant to the word 'keyword' and the phrase 'keyword density' because both occur many times. More importantly, the ratio of their occurances to the total number of words or phrases on the page is reasonably high because, well, they occur a bunch of times.

That's what keyword density is about. The keyword density of the word "keyword" is calculated by counting the total number of words on the page, then figuring out how many of them are "keyword". Typical highly-ranked sites have at least a 2-3% keyword density for the key search word or search phrase.



http://www.free-web-money.com/000437.html

Friday, January 14, 2005

Crypto-Gram Newsletter December 2004

Crypto-Gram Newsletter:
December 15, 2004

“In this issue:


Description of Internet Explorer security zones registry entries

Description of Internet Explorer security zones registry entries:

“This article describes how and where Internet Explorer security zones and privacy settings are stored and managed in the registry. You can use Group Policy or the Microsoft Internet Explorer Administration Kit (IEAK) to set security zones and privacy settings. If you are using Group Policy or IEAK on a Microsoft Windows 2000-based computer, you may have to install several hotfixes to set security zones and privacy settings.


For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 316116 You cannot manage Internet Explorer 6 Group Policies on a Windows 2000-based computer

Microsoft Knowledge Base:182569

http://support.microsoft.com/default.aspx?scid=kb;en-us;182569

Using a Least-Privileged User Account

Using a Least-Privileged User Account:

“Anyone who has been a victim of viruses, worms, and other malicious software (malware) will appreciate the security principle of “least privilege.” If all processes ran with the smallest set of privileges needed to perform the user's tasks, it would be more difficult for malicious and annoying software to infect a machine and propagate to other machines. Today, due to awkward complications that arise when it is employed, least privilege is not in active use on most Microsoft Windows–based systems. However, with the release of the next Windows operating system, codenamed “Longhorn,” almost every user will be able to make regular, daily use of this important security principle.

The Security Principle of Least Privilege

If low-privileged processes are compromised, they will do a lot less damage to a system than high-privileged processes are capable of doing. Consequently, using a non-administrator account instead of an administrator account while completing daily tasks offers the user added protection against infection from a host of malware, external or internal security attacks, accidental or intentional modifications to system setup and configurations, and accidental or intentional access to confidential programs or documents.

Given the obvious security benefits, there is a huge desire, both in home and corporate environments, to run Windows using non-administrator accounts. Unfortunately, almost all Windows users today continue to use an administrator account for their daily tasks. A host of nefarious users and applications rely on being able to use the victim's administrator privileges for such dirty work as destroying or stealing data, reconfiguring another application, or installing a key logger that sends each of the unsuspecting user's keystrokes off to some unknown location on the other side of the Internet.…”

http://www.microsoft.com/technet/security/secnews/articles/lpuseacc.mspx


Running with an administrative account is dangerous to the health of your computer and your data

Running with an administrative account is dangerous to the health of your computer and your data:
Michael Howard
Microsoft Security Engineering
“So, whenever someone says they must operate their computers as administrators, I always try to persuade them it's not the correct thing to do from a security perspective. That said, every once in a while I meet someone who has a valid reason. For example, I use one of the computers in my office to install the latest daily build of Windows, and I need to be an administrator to install the OS. However, and this is a big point, I do not read e-mail, browse the Web, or access the Internet in any form when running as an administrator on that machine. And I do not do so because the Web is the source of most of the nasty attacks today.

What if someone does want to browse the Web? Or read e-mail? Or do Instant Messaging and so on, and for some reason must run in an administrative context? If you look at the major threats to computers, they are from user interaction with the Web through tools like browsers and e-mail clients. Sure, there are non-user interaction attacks, such as Blaster (http://www.cert.org/advisories/CA-2003-20.html) and Lion (http://www.sans.org/y2k/lion.htm), but that's in part why we turned on the firewall in Windows XP SP2!”

Note For Best practices on running as a non-admin, I urge you to look over Aaron Margosis' blog to glean tips on running as a non-admin in Windows.


http://msdn.microsoft.com/security/securecode/columns/default.aspx?pull=/library/en-us/dncode/html/secure11152004.asp

OnlineAuction.com Makes Bid for eBay Sellers

OnlineAuction.com Makes Bid for eBay Sellers:

“Tired of high listing fees on eBay? So was Chris Fain. That's why he created OnlineAuction.com, the newest competitor to the online auction giant. The new service was officially launched on Monday.

"We are sure OnlineAuction.com buyers will love the true competitive bidding without the fear of getting sniped. Our sellers will love the billing structure of one low $8monthly fee, with no individual listing or final value fees. Why? Because we know what it is like trying to decipher a listing bill that looks so complex you need a 'New York lawyer' to figure it out," the company claims on its Web site.

Seven years in the making, OnlineAuction.com's selling point is its low all-inclusive monthly fee.

"At OnlineAuction.com, no matter how much you sell or how much you sell it for, the fee is still only $8 a month, period," said Fain, CEO of OnlineAuction.com on Monday during an interview with Car and Driver Radio where he unveiled the new service. "There's no place else you can get worldwide advertising for $96 a year -- not print, not radio and certainly not television."

Fain made a living selling millions of dollars in merchandise on eBay for several years. However, he still paid approximately $20,000 in listing fees, which ate into his profits.

OnlineAuction.com takes aim at what it sees as frustrating and unnecessary flaws in the eBay world. For example, eBay charges sellers a re-listing fee for items that do not sell. OnlineAuction.com does not. In fact, unsold items are automatically re-listed on the site. In addition to listing fees, eBay also takes a percentage of each sale or charges "transaction fees" once an item is bid on, even if the item doesn't sell.

For example, selling a car on eBay would cost $40 for the listing and an additional $40 once a bid is made. On OnlineAuction.com, you still only pay the $8 monthly fee.

OnlineAuction.com also vows never to shut down auctions and restrict verified, legitimate sellers from selling, unlike Ebay, which can shut down a seller's ability to function for more than a week if it thinks the seller is operating in bad faith. eBay has been criticized for being difficult to contact, The company offers no customer service phone numbers and communicates via an automated response system.”


http://www.ecommerce-guide.com/news/news/article.php/3458131

CSS Tooltips - Part One

CSS Tooltips - Part One:
By: John Gallant , Holly Bergevin ,

“This tutorial is meant for those familiar with basic CSS syntax and usage. If this is not you, The following discussion will make more sense after you have studied these articles:

Tooltip Talk

A common part of modern web pages and applications are those handy little text boxes that pop up when some elements are moused over. In web pages these tooltips are usually generated via the title attribute, which can display a small bit of explanatory text for that page element, without otherwise cluttering up the page. This is often quite helpful, but the display of the title attribute is in the hands of the browser, and they all have different ideas about how to handle them, particularly when the text is long enough to need more than one line.

Other than depending on browsers' displays, there is no author accessible mechanism to style these attribute-based "tooltips." There are oodles of JavaScripts that will dynamically create "faux tooltips," but if one wishes to avoid JavaScript, then it's been the boring title attribute "tooltips" or nothing at all. If only there was some way of forcing CSS to style those "tooltips"!

Well, CSS can't actually style browser-based "tooltips," but CSS can create "faux tooltips" much the same as the JavaScript ones, but without all the (possibly) undesirable scripting. There are a few in's and out's involved, but surprisingly, the methods are rather easy to accomplish.”


http://www.communitymx.com/content/article.cfm?cid=4E2C0

Thursday, January 13, 2005

Will Microsoft's monoculture take the 'pod' out of podcasting?

Will Microsoft's monoculture take the 'pod' out of podcasting?:

“Connecting the dots between the current state of podcasting and Microsoft's joint announcements with TiVo coming out of CES last week results in a picture worth viewing by any technologist (enterprise, consumer, vendor, and podcaster).

Podcasting is a marriage of the TiVo concept (though TiVo itself is not involved) to Internet-delivered audio. In broadcaster-speak, TiVo facilitates "time-shifted consumption." As with the VCR, broadcasts get recorded and digital video recorders (DVRs) like the TiVo facilitate the consumption of these broadcasts at your convenience. Originally, consumption of time-shifted broadcasts required the DVR. But, in the case of TiVo, technologies like TiVoToGo that promise to burn those broadcasts onto DVDs will mobilize those time-shifted broadcasts. In the context of podcasting, the DVR experience is vastly superior to that of the VCR for two reasons. First, it greatly simplifies the notion of broadcast subscription because you get to pick the specific programs you want to record as opposed to picking a channel and setting the recording start and end times. From the TV Guide in our DVR, my wife simply finds the listing for Desperate Housewives and presses the record button. Second, the way the DVR digitally records the broadcasts onto a hard drive makes the messy business of VCR tapes a thing of the past.

What's in a name? Why is it called "Podcasting?" The first time that Internet-accessible MP3-based broadcasts turned up on the hard drive of a portable MP3 player -- without a middleman like Audible.com -- was with Apple's iPod. As a recent press release from the WNYC affiliate of cost-conscious National Public Radio put it, "Distinct from fee-based services like audible.com, podcasts are free and can be saved to iPods (hence, the name) or any other MP3 player." WNYC announced that NPR's On the Media is being made available as a podcast.

It is primarily two technologies that made podcasting possible. First, an AppleScript written by ex-MTV video jockey-cum podcasting poster child Adam Curry whisked an audio file off the Internet and into an iPod. The second was the RSS protocol, which, under the stewardship of Dave Winer, is not only what facilitates the ability to subscribe to a specific podcaster's program (much the same way you can subscribe to blogs or ZDNet's news feeds), but also supports the notion of enclosures. As can be seen from one of Winer's very recent postings, the work of incorporating enclosures into RSS feeds is far from over.

With a blog authoring platform like Userland's Radio that gives users a way to attach an audio file's URI to a blog entry as though it were an enclosure, the resulting RSS feed goes out with an enclosure field that can be parsed by an enclosure-aware RSS client like iPodder (an open-source successor to Curry's AppleScript that's the result of a collaboration between Winer and Curry). The audio file itself is not part of the feed. Only its URI is. What this means for the producers of podcasts is that they still must find a Web accessible host like the storage locker that AOL is testing to store their audio files -- which can be sizeable. Our first podcast was 22.6 MB and Curry's files routinely run in the 15- to 20MB range. As an enclosure-aware client, iPodder knows exactly what to do when it encounters the URI to an audio file in a blog entry's enclosure field. As an aside, enclosure-aware blog hosts (like Userland's Radio) will also know what to do with the enclosure. As can be seen from ZDNet's podcast test center, any blog entry that has an audio file enclosure with it also gets an icon (resembling a bullhorn) that is linked directly to the audio file.

Now that TiVo-like time-shifted consumption of the "audio Web" is built, will content authors and consumers come? They're already here. Hundreds if not thousands of podcasters are producing content and, as exemplified by WNYC's announcement, more are coming on-line every day. According to Release 1.0 (a CNET Networks sister outfit to ZDNet), Googling the term "podcast" yielded 300 search results in October 2004. Already, in early January 2005, that number is up to 1 million (having climbed by 150,000 results in just one week). By all accounts, the podosphere appears destined for a presence in digirati culture comparable to the blogosphere.

But, as also indicated by WNYC's press release, despite the art still being referred to as podcasting, Apple's iPod is no longer the only last stop for the circuitous route that a podcast travels before it gets consumed. The software has evolved to the point that podcasts are easily consumed by other MP3 players as well, and through other synchronization conduits such as Windows Media Player.

Such evolution was only natural. (Microsoft did nothing to make that happen.) However, Apple failed to seize the natural advantage that was gifted to it by Adam Curry when his first AppleScript changed the course of the audio Web. Had I been Steve Jobs, I would have marshaled every engineer needed to produce the GarageBand equivalent of a podcast authoring tool for the Mac and to turn the iPod into the ultimate podcast endpoint. Not only would I make them capable of reading the Outline Processor Markup Language-based (OPML) outlines that podcasters are using to describe the content (known as "shownotes") within their podcasts (for example, this outline for one of Adam Curry's podcasts) , but I'd also make them capable of managing podcast subscriptions without the need for a middleman like iPodder. At the very least, I'd fund the open source iPodder project, try to take on Dave Winer and Adam Curry as consultants (not that they'd accept), and build all of the functionality of iPodder into iTunes (turning iTunes into an enclosure-aware RSS client).

Recipes for creating podcasts with the Mac and Windows get the job done, but they basically involve a handful of technologies that must be alligator-clipped together.

Not only doesn't Apple seem interested in greasing the wheels of the podosphere, it doesn't appear interested in what big content publishers like ZDNet would like to see happen. So far, I've received no response from Apple to an e-mail inquiry regarding ideas for how podcast authoring and consumption (on the Mac platforms) could be vastly improved.… ”



http://news.zdnet.com/2100-9588_22-5519810.html?tag=nl.e539

Gmail Bug Exposes E-mails to Hackers

Gmail Bug Exposes E-mails to Hackers :
“UNIX developers HBX Networks have stumbled upon a bug within Google's Gmail that allows access to other users' personal e-mails.

By altering the "From" address field of an e-mail sent to the service, hackers could potentially find out a user's personal information, including passwords.

At first glance, to the average user the e-mail would appear normal. But by clicking "show options" within the Gmail interface, the "Reply-To" field will show HTML code that is actually a formatted version of another user's e-mail, HBX wrote on its Web site.

HBX said that they think a missing character is tripping up Gmail and causing it to print whatever is in its cache, or memory, into the Reply-To field.

The group did say much of what they saw was spam. However, what troubled them was in at least one case they were able to see a user's password.

Quick to respond, Google acknowledged the problem late Wednesday and has since corrected the problem for all users, a company source said.

At first glance, to the average user the e-mail would appear normal. But by clicking "show options" within the Gmail interface, the "Reply-To" field will show HTML code that is actually a formatted version of another user's e-mail, HBX wrote on its Web site.

HBX said that they think a missing character is tripping up Gmail and causing it to print whatever is in its cache, or memory, into the Reply-To field. The group did say much of what they saw was spam. However, what troubled them was in at least one case they were able to see a user's password.

“Regardless of the specific failure, the result is a compromise of the privacy of communications over Gmail,” the organization said. “Usually, this only permits an attacker to examine recently-arrived spam in random user's inboxes - but message content does occasionally become more interesting.””


http://www.betanews.com/article/Gmail_Bug_Exposes_Emails_to_Hackers/1105561408

http://www.eweek.com/article2/0,1759,1750785,00.asp?kc=ewnws011305dtx1k0000599

Red Hat, SuSE release Linux patches

Red Hat, SuSE release Linux patches:
“Linux vendors Red Hat, Novell and Mandrakesoft on Wednesday released patches for several vulnerabilities, ranging from flaws that could allow denial-of-service attacks to buffer overflows.

Five of the updates released were rated "highly critical" on Thursday by security information company Secunia. Red Hat released three of the updates, Novell's SuSE one and Mandrakesoft one.

SuSE issued updates to resolve flaws including a vulnerability that could allow malicious code to cause a local denial-of-service attack using a specially created Acrobat document. The vulnerabilities would affect most SuSE Linux-based products.

Another vulnerability in the Linux system components used to route network traffic could allow a malicious person to execute a local denial-of-service attack by inserting erroneous information into the netfilter data stream, according to SuSE.

Red Hat, meanwhile, issued a package of updates for its desktop, enterprise and advanced-workstation software.

An updated libtiff package was released to address vulnerabilities involving various integer overflows. The vulnerabilities would enable an attacker who has tricked a user into opening a malicious image file in the TIFF format to make a libtiff-related application crash or have the potential to compromise the computer with arbitrary code.

Red Hat also released updates for Xpdf packages to address a vulnerability to a potential buffer overflow. Xpdf is a stand-alone application for reading Portable Document Format documents and is also used by many Linux programs to process PDF files. This vulnerability could enable an attacker to create a PDF file that would crash Xpdf and possibility execute arbitrary code when opened, according to Red Hat's update.

Red Hat also released multiple patches to resolve flaws in its Xpm library. The XPixMap (XPM) format enables color images to be stored in an easily portable file.

Several stack overflow flaws and an integer overflow vulnerability were found in the libXpm library, which, in turn, is used to decode XPM images. If an attacker creates an XPM file that causes an application to crash, a computer system could be compromised.

Mandrakesoft also released an update for Imlib, a standard set of code used by older versions of the GNOME desktop to process graphics.”

http://news.zdnet.com/2100-1009_22-5535228.html?tag=nl.e589

Hackers Tune In to Windows Media Player

Hackers Tune In to Windows Media Player :

“Hackers are using the newest DRM technology in Microsoft's Windows Media Player to install spyware, adware, dialers and computer viruses on unsuspecting PC users.

Security researchers have detected the appearance of two new Trojans, Trj/WmvDownloader.A and Trj/WmvDownloader.B, in video files circulating on P2P (peer-to-peer) networks.

According to Panda Software, both Trojans take advantage of the new Windows anti-piracy technology to trick users into downloading spyware and adware applications.

"When a user tries to play a protected Windows media file, this technology demands a valid license. If the license is not stored on the computer, the application will look for it on the Internet, so that the user can acquire it directly or buy it," Panda Software explained.

An unsuspecting user attempting to download the DRM (digital rights management) license will instead be redirected to a Web site that loads a large quantity of adware, spyware, modem dialers and other viruses, the company said in an advisory.

"It's pretty ingenious," said Patrick Hinojasa, chief technical officer at Panda Software. "To take an anti-piracy feature and use it to feed spyware is extremely ironic."

"In this case, they're using technology meant to secure content. It just shows that the more bells and whistles you add to the technology, the more you open doors for the bad guys," he said.

Even though these Trojans have been detected in video files on P2P networks such as Kazaa or eMule, Hinojasa warned that these files can be distributed via e-mail, FTP or other Internet download avenues.”


http://www.eweek.com/article2/0,1759,1749948,00.asp


Monday, January 10, 2005

High-Risk Flaws Flagged in IE, Mozilla

High-Risk Flaws Flagged in IE, Mozilla :
“Security researchers have raised the alarm for a series of unrelated, high-risk vulnerabilities in Microsoft Corp.'s Internet Explorer and the open-source Mozilla browsers.

According to a Secunia advisory, the most serious IE flaw could be exploited by a malicious hacker to hijack a vulnerable machine, conduct cross-site/zone scripting and bypass a security feature in Microsoft Windows XP SP2.

For its part, Microsoft has confirmed it is investigating a "Click and Scroll" issue in IE and has posted a temporary workaround to protect users from the flaw.

In a Knowledge Base article, the software company said the bug could make it possible for an attacker to put a malicious file on a PC if a user visits a Web site.

Microsoft recommends that users install the most recent cumulative fix for IE and disable the "drag-and-drop" or "copy-and-paste files" option across a domain.

Another unpatched IE flaw could allow an embedded HTML Help control on a malicious Web site to execute local HTML documents or inject arbitrary script code.

A third vulnerability exists in the handling of the "Related Topics" command in an embedded HTML Help control. Secunia said this bug can be exploited to launch harmful script code in the context of arbitrary sites or zones.

Secunia has posted a vulnerability test online to demonstrate the flaws.

The updated IE warning comes on the heels of a Bugtraq advisory for multiple flaws in Mozilla, Firefox and Thunderbird products.

The Mozilla Foundation has rolled out new versions to patch the holes, which range from a potential buffer overflow and temporary files disclosure to anti-spoofing issues.

According to the advisory, a potentially exploitable buffer overflow was discovered in the way Mozilla and Firefox handle NNTP URLs.

Also fixed is a way of spoofing filenames in the "What should Firefox do with this file" dialog-box option.

"A remote attacker could craft a malicious NNTP link and entice a user to click it, potentially resulting in the execution of arbitrary code with the rights of the user running the browser," the advisory read.”


http://www.eweek.com/article2/0,1759,1749293,00.asp?kc=ewnws011005dtx1k0000599


Saturday, January 08, 2005

Microsoft to Serve Up Monthly Virus Zapper :
“Microsoft Corp. on Thursday said it plans to release a virus detection and removal tool on Jan. 11. The antivirus fighter will be updated on the second Tuesday of every month as part of the company's scheduled software patching cycle.

Meanwhile, exactly three weeks after acquiring anti-spyware startup Giant Company, Redmond released the first public beta as a free Windows download through July 31.

Redmond also plans to release a virus detection and removal tool on Jan. 11, which will be updated on the second Tuesday of every month as part of the company's scheduled software patching cycle.

As previously reported, the spyware zapper is an exact replica of the Giant Company application acquired late last year.

Microsoft has retained all of the key Giant AntiSpyware features, including RealTime Detection, AutoUpdater, Spyware Scan and the widely hailed SpyNet Community network, which provides an early-warning mechanism.

Microsoft officials declined to discuss what happens after the beta expires in July, but analysts expect the company to start charging for definition updates once the spyware detection and removal tool goes gold.

The addition of a worm zapper to the monthly Patch Day schedule is a change from the previous policy of releasing individual removal tools after a major virus outbreak.

Using expertise and technology acquired from anti-virus vendor GeCAD, Microsoft's malicious software removal tools will consolidate previously released tools for the Blaster, MyDoom and Download.Ject attacks.”

http://www.eweek.com/article2/0,1759,1748869,00.asp


Three unpatched flaws in Internet Explorer

Three unpatched flaws in Internet Explorer:

“Secunia said Friday that it had raised its rating of the vulnerabilities in Microsoft's browser to "extremely critical," its highest rating. The flaws, which affect IE 6, could enable attackers to place and execute programs such as spyware and pornography dialers on victims' computers without their knowledge, said Thomas Kristensen, Secunia's chief technology officer.

Exploit code for one of the vulnerabilities, a flaw in an HTML Help control, was published on the Internet on Dec. 21 in an advisory by GreyHats Security Group.

"In order for us to rate a vulnerability as extremely critical, there has to be a working exploit out there and one that doesn't require user interaction," Kristensen said. "This is our highest rating and is the last warning for users to fix their systems."

The exploit code can be used to attack computers running Windows XP even if Microsoft's Service Pack 2 patch has been installed, Secunia said. The company is advising people to disable IE's Active X support as a preventative measure, until Microsoft develops a patch for the problem. It also suggests using another browser product.

The Secunia advisory also warns of another HTML Help control vulnerability that, when used in combination with a drag-and-drop flaw, could be used to attack PCs--though in that case, it would have to be with the interaction of the victim. The company first issued an alert about the three security holes in October.”

Microsoft said it was investigating the public reports of the exploit, adding that the delay in fixing the IE patch was related to the extensive work needed to produce an effective patch.

The company is advising people to check its safe browsing guidelines and to set their Internet security zone settings to "high." It also suggests that people continue installing automatic security updates from Service Pack 2.

Secunia also offers users the ability to conduct an online test of their systems to see if they are vulnerable.

http://dw.com.com/redir?destUrl=http%3A%2F%2Fsecunia.com%2Finternet_explorer_command_execution_vulnerability_test%2F&siteId=22&oId=2100-1009-5517457&ontId=1009&lop=nl.ex

http://news.zdnet.com/2100-1009_22-5517457.html?tag=nl.e589

Wednesday, January 05, 2005

CSS Crib Sheet

CSS Crib Sheet:

“You will no doubt come across many quirky layout issues when building a site with CSS. You'll end up banging your head against a wall time and again. This is an attempt to make the design process easier, and provide a quick reference to check when you run into trouble.”

Translations are available in Français, Deutsch, Italiano, Magyar, Finnish, Norwegian, Russian, Portuguese, Japanese and Simplified Chinese.

CSS Problem-Solving http://www.mezzoblue.com/archives/2004/03/10/css_problems/index.php

http://www.mezzoblue.com/css/cribsheet/

Tuesday, January 04, 2005

Firefox has much to learn

Firefox has much to learn:
by George Ou

“It is widely asserted as "fact" that Firefox is more secure, but does that assertion really hold up under intense scrutiny? Peter Torr of Microsoft doesn’t seem to think so. I can hear the howling now to the effect of "but the guy is just a Microsoft lackey on Bill Gate’s payroll". While it is certainly true that he works for Microsoft and is clearly giving a point of view favorable to Microsoft, no one can deny any of the serious criticisms that he lays on Firefox. Here is a list of Peter’s grievances that show a pretty flagrant disregard for the most basic of security principles.”

  • Installing Firefox requires downloading an unsigned binary from a random web server
  • Installing unsigned extensions is the default action in the Extensions dialog
  • There is no way to check the signature on downloaded program files
  • There is no obvious way to turn off plug-ins once they are installed
  • There is an easy way to bypass the "This might be a virus" dialog

Since the initial posting and much "fanfare" from Slashdot, someone pointed how you can turn off plug-ins so Peter has since then conceded the fourth point. While there has been a huge firestorm of responses on the other points, I haven’t heard any acceptable explanations on any of the other four points that Peter has raised. The most serious issue is the first where Firefox might even send you to a raw IP address link (the favorite tactic of phishers) to download unsigned code.


http://blogs.zdnet.com/Ou/index.php?p=22&tag=nl.e539

Podcasting: Evolution or Revolution?

Podcasting: Evolution or Revolution?:
“Podcasting is getting all kinds of press. The buzz generated from this so-called phenomenon harkens back to the pre-2000 Internet, when the next big thing solved problems yet to be realized by the people in need of the solution. Is podcasting to iPods really what Tivo is to television? .”

Jake Ludington explores
  1. Podcast Basics
  2. How Do I Subscribe to a Podcast?
  3. Podcasting and Windows Media Player
  4. Join the Podcast Revolution

http://www.informit.com/articles/article.asp?p=360067

The Basics of Cascading Style Sheets

The Basics of Cascading Style Sheets:
“CSS, if used correctly, can greatly extend your ability to create attractive Web designs. Learn how you can use styles to enhance your Dreamweaver MX 2004 web page. ”

In this article
  • A Brief Introduction to Styles
  • Designing with CSS
  • Style Properties
  • Working with CSS Styles
  • Editing CSS in Code View

The cascading style sheets (CSS) language is a way to describe the appearance of Web pages by assigning styles to specific HTML tags and portions of the page. These styles allow a designer greater range of presentational effects than can be achieved by using only HTML styles. Dreamweaver MX 2004 makes it easy to edit and apply style sheets to new or existing Web documents.

If you're already familiar with CSS, you can skip over the following introduction and go directly to "Designing with CSS" to use Dreamweaver MX 2004 to build Web pages using styles.


http://www.informit.com/articles/article.asp?p=355339

Thursday, December 30, 2004

Download boot disks for all your needs from these Web sites

Download boot disks for all your needs from these Web sites:
“You no longer have to create your own boot disks--others have done the work for you and uploaded their files to the Internet.

Why create a custom boot disk yourself when you can download one quickly and hassle free from a Web site? Many Web sites offer downloadable programs for creating custom boot disks, but of course, some are better than others in terms of their content and page layout. A quick look at some of the most popular of these sites will help you decide where you can find the best one-stop shop for your boot disk needs.”

Free Registration

http://techrepublic.com.com/5102-6270-5034303.html

How Does Google Figure out What Pages are More Relevant? Pagerank

How Does Google Figure out What Pages are More Relevant? Pagerank:

“A core question for anyone on the Web, and certainly a question you should be asking if you're trying to monetize your Web site, is how the heck does Google figure out what sites are more relevant to a given search than others?

Dave Taylor helps you understand Pagerank, a critical first step in increasing the visibility of your website in Google searches.”

http://www.informit.com/articles/article.asp?p=360068

Clean HTML from Word: Can It Be Done?

Clean HTML from Word: Can It Be Done?:
“Laurie Rowell's short answer to the question above: Yes, with a bit of effort. With a number of utilities available at relatively low cost, you can finagle Microsoft Word's output to something that resembles clean HTML. You might need to roll up your sleeves and dig around in the code or the formatting (depending on the application you choose), but you should end up with something you can put on the web without shame.”

Free membership available

http://www.informit.com/articles/article.asp?p=359433

Thursday, December 23, 2004

Browsers as test platforms

Browsers as test platforms:
“Browsers from a developer's point of view. When developing for the web, it is inevitable that we need to debug and test our work. How easy or how hard is it to find the problems causing errors and how easy is it to replicate certain environment changes? Once we identified the steps we need to take to test properly, we will see if there is a chance to extend the browser to make these steps a lot easier.”

The development environment is an PC running Windows XP, in this case a IBM Thinkpad T40 with 1GB of Ram and a Centrino 1300MHz processor.

We will take a look at Microsoft Internet Explorer 6, Mozilla Firefox 1.0 preview release and Opera 7.50.

For testing, we will use a web site template with some HTML errors and a Javascript error.

What we want to test is:

  • Why is the Javascript not working (i.e. why is the menu not collapsing)?
  • Why is the site not being displayed correctly?
  • Why does the form not get sent off?
  • How does the design behave with different font sizes?
  • How does the page work without CSS, or Javascript or images?

Debugging the HTML

We will check how comfortable the source view is in the browser, and if it provides us with extra tools to check the HTML structure.

Debugging the Javascript

We will test how easy it is to trace back Javascript errors. Does the browser tell us the error? How easy is it to see the error messages?

Debugging the CSS

When using CSS seriously, we need to avoid Quirksmode at all costs. Quirksmode is a feature that was added into modern browsers to ensure backward compatibility and forces it to render pages like its predecessor. This makes it nearly impossible to predict the outcome, and forces us to keep developing for the past rather than for the future. We can force browsers to render web sites properly - in standards mode - by giving them the correct DOCTYPE [1]. To see what went wrong with our CSS, we need to find out whether the browser renders in Quirksmode or not.

Testing the accessibility of our page

To test how accessible our page is, we can take a quick look to see how it renders without CSS, Javascript or any of them. Furthermore, we want to resize the font of the browser to check if that breaks our design.


http://icant.co.uk/forreview/browsertests/

Wednesday, December 22, 2004

Windows Security Updates Summary for December 2004

Windows Security Updates Summary for December 2004:

“The Microsoft Windows security updates for December 2004 include several important updates and a critical cumulative update for Microsoft Internet Explorer 6 Service Pack 1 (SP1), a component of Windows. If you have any of the software listed on this page installed on your computer, you should visit the Windows Update Web site to install related updates.

Supported software affected
  • Internet Explorer 6 SP1 on Windows 2000 SP3, Windows 2000 SP4, or Windows XP SP1
  • Internet Explorer 6 SP1 on Windows NT Server 4.0 SP6a; Windows NT Server 4.0, Terminal Service Edition SP6; Windows 98; Windows 98 SE; or Windows Me
  • Internet Explorer 6 for Windows XP 64-Bit Edition SP1

Note Updates for Windows Millennium Edition, Windows 98, and Windows 98 Second Edition are being made available under extended support for critical security issues.”


http://www.microsoft.com/security/bulletins/200412_windows.mspx

Net worm using Google to spread

Net worm using Google to spread:

“A Web worm that identifies potential victims by searching Google is spreading among online bulletin boards using a vulnerable version of the program phpBB, security professionals said on Tuesday.

The Santy worm uses a flaw in the widely used community forum software known as the PHP Bulletin Board (phpBB) to spread, according to updated analyses. The worm searches Google for sites using a vulnerable version of the software, antivirus firm Kaspersky said in a statement.

Almost 40,000 sites may have already been infected. Using Microsoft's Search engine to scan for the phrase "NeverEverNoSanity"--part of the defacement text that the Santy worm uses to replace files on infected Web sites--returns nearly 39,000 hits.

"Santy.a is spreading rapidly," antivirus firm Kaspersky stated in a new release published Tuesday. "However, this does not directly affect users. Although the worm infects Web sites, it does not infect computers used to view those sites."

The worm sends Google a specific search request, essentially asking for a list of vulnerable sites. Armed with the list, the worm then attempts to spread to those sites using a PHP request designed to exploit the phpBB bulletin board software.

The worm is the latest twist on using Google as an attack tool, a practice known as Google hacking. It may also be the first time a program used Google to identify victims for an attack.…”


http://news.zdnet.com/2100-1009_22-5499725.html

Tuesday, December 21, 2004

Producing a High-Definition Windows Media Video File

Producing a High-Definition Windows Media Video File:
“This document provides information about creating high-definition Microsoft Windows Media Video files. Topics covered include an overview of the content creation process, a list of acceptable video sources, information about the capturing and encoding processes, and system requirements for encoding and playing a high-definition Windows Media Video file.

By using Microsoft Windows Media Encoder 9 Series, you can create high-definition Windows Media Video files in the high-definition television (HDTV) standard formats, such as 1280 x 720 progressive (720p), 1920 x 1080 interlaced (1080i), or 1920 x 1080 progressive at 23.976 fps (1080Psf). The process of creating a high-definition Windows Media Video file consists of the following steps:
  1. Capture the content from a high-definition source.
  2. Edit the content (optional).
  3. Convert the content to an .avi file.
  4. Encode the content.

Note that you can use software, such as Sonic Foundry Vegas or Discreet CleanerXL, to combine the four steps into a single step. For more information about these programs, see the Sonic Foundry Web site http://go.microsoft.com/fwlink/?LinkId=14986 or the Discreet Web site http://go.microsoft.com/fwlink/?LinkId=15004.”

http://www.microsoft.com/windows/windowsmedia/
howto/articles/ProducingHDVideo.aspx

Monday, December 20, 2004

Web Design: A Decade Under the Influence

Web Design: A Decade Under the Influence:

“Full streaming video feeds of some of most noteworthy sessions at this month's Web Design World 2004 have been published for your education and entertainment.

Keynotes from Jeffrey Zeldman and Kelly Goto are joined by sessions on rich media web apps (Tom Green), defensive web design (37signal's Jason Fried), as well as sessions on accessibility, XML and more.”


http://www.ftponline.com/reports/wdwboston/2004/




Crop Images Contextually

Crop Images Contextually:

“Cropping and resizing your images for the Web is a common technique for creating smaller thumbnail images that download quickly. However, we've seen many sites that either use HTML's width and height attributes to resize larger images, or minimally crop and resize their images to lose vital information (see Figure 1). A better way to create images optimized for the Web is to crop them contextually.”

What is cropping contextually? Many times digital images shot for Web use have a border of useless space around the object(s) of interest. Rather than crop to just the film or chip's border, crop contextually down to the minimum dimensions that still convey the meaning or context of your image…

http://www.websiteoptimization.com/speed/tweak/crop/